pwntools 0.1.0 → 1.2.1

data/lib/pwnlib/pwn.rb

@@ -1,26 +1,44 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
 
-# require this file would also require all things in pwnlib, but would not
-# pollute anything.
+# require this file would also require all things in pwnlib, but would not pollute anything.
 
+require 'pwnlib/asm'
 require 'pwnlib/constants/constant'
 require 'pwnlib/constants/constants'
 require 'pwnlib/context'
 require 'pwnlib/dynelf'
+require 'pwnlib/elf/elf'
+require 'pwnlib/errors'
+require 'pwnlib/logger'
 require 'pwnlib/reg_sort'
-
+require 'pwnlib/runner'
+require 'pwnlib/shellcraft/shellcraft'
+require 'pwnlib/tubes/process'
+require 'pwnlib/tubes/serialtube'
+require 'pwnlib/tubes/sock'
+require 'pwnlib/ui'
 require 'pwnlib/util/cyclic'
 require 'pwnlib/util/fiddling'
+require 'pwnlib/util/getdents'
 require 'pwnlib/util/hexdump'
+require 'pwnlib/util/lists'
 require 'pwnlib/util/packing'
 
-# include this module in a class to use all pwnlib functions in that class
-# instance.
+# include this module in a class to use all pwnlib functions in that class instance.
 module Pwn
+  include ::Pwnlib::Asm
   include ::Pwnlib::Context
+  include ::Pwnlib::Logger
+  include ::Pwnlib::Runner
+  include ::Pwnlib::UI
+  include ::Pwnlib::Util::Cyclic
+  include ::Pwnlib::Util::Fiddling
+  include ::Pwnlib::Util::HexDump
+  include ::Pwnlib::Util::Lists
+  include ::Pwnlib::Util::Packing
 
-  include ::Pwnlib::Util::Cyclic::ClassMethods
-  include ::Pwnlib::Util::Fiddling::ClassMethods
-  include ::Pwnlib::Util::HexDump::ClassMethods
-  include ::Pwnlib::Util::Packing::ClassMethods
+  def shellcraft
+    ::Pwnlib::Shellcraft::Shellcraft.instance
+  end
 end

data/lib/pwnlib/reg_sort.rb

@@ -1,127 +1,126 @@
 # encoding: ASCII-8BIT
+# frozen_string_literal: true
 
 require 'pwnlib/context'
+require 'pwnlib/util/ruby'
 
 module Pwnlib
   # Do topological sort on register assignments.
   module RegSort
-    # @note Do not create and call instance method here. Instead, call module method on {RegSort}.
-    module ClassMethods
-      # Sorts register dependencies.
-      #
-      # Given a dictionary of registers to desired register contents,
-      # return the optimal order in which to set the registers to
-      # those contents.
-      #
-      # The implementation assumes that it is possible to move from
-      # any register to any other register.
-      #
-      # @param [Hash<Symbol, String => Object>] in_out
-      #   Dictionary of desired register states.
-      #   Keys are registers, values are either registers or any other value.
-      # @param [Array<String>] all_regs
-      #   List of all possible registers.
-      #   Used to determine which values in +in_out+ are registers, versus
-      #   regular values.
-      # @option [Boolean] randomize
-      #   Randomize as much as possible about the order or registers.
-      #
-      # @return [Array]
-      #   Array of instructions, see examples for more details.
-      #
-      # @example
-      #   regs = %w(a b c d x y z)
-      #   regsort({a: 1, b: 2}, regs)
-      #   => [['mov', 'a', 1], ['mov', 'b', 2]]
-      #   regsort({a: 'b', b: 'a'}, regs)
-      #   => [['xchg', 'a', 'b']]
-      #   regsort({a: 1, b: 'a'}, regs)
-      #   => [['mov', 'b', 'a'], ['mov', 'a', 1]]
-      #   regsort({a: 'b', b: 'a', c: 3}, regs)
-      #   => [['mov', 'c', 3], ['xchg', 'a', 'b']]
-      #   regsort({a: 'b', b: 'a', c: 'b'}, regs)
-      #   => [['mov', 'c', 'b'], ['xchg', 'a', 'b']]
-      #   regsort({a: 'b', b: 'c', c: 'a', x: '1', y: 'z', z: 'c'}, regs)
-      #   => [['mov', 'x', '1'],
-      #       ['mov', 'y', 'z'],
-      #       ['mov', 'z', 'c'],
-      #       ['xchg', 'a', 'b'],
-      #       ['xchg', 'b', 'c']]
+    module_function
+
+    # Sorts register dependencies.
+    #
+    # Given a dictionary of registers to desired register contents, return the optimal order in which to set the
+    # registers to those contents.
+    #
+    # The implementation assumes that it is possible to move from any register to any other register.
+    #
+    # @param [Hash<Symbol, String => Object>] in_out
+    #   Dictionary of desired register states.
+    #   Keys are registers, values are either registers or any other value.
+    # @param [Array<String>] all_regs
+    #   List of all possible registers.
+    #   Used to determine which values in +in_out+ are registers, versus regular values.
+    # @param [Boolean] randomize
+    #   Randomize as much as possible about the order or registers.
+    #
+    # @return [Array]
+    #   Array of instructions, see examples for more details.
+    #
+    # @diff We don't support +tmp+/+xchg+ options because there's no such usage at all.
+    #
+    # @example
+    #   regs = %w(a b c d x y z)
+    #   regsort({a: 1, b: 2}, regs)
+    #   #=> [['mov', 'a', 1], ['mov', 'b', 2]]
+    #   regsort({a: 'b', b: 'a'}, regs)
+    #   #=> [['xchg', 'a', 'b']]
+    #   regsort({a: 1, b: 'a'}, regs)
+    #   #=> [['mov', 'b', 'a'], ['mov', 'a', 1]]
+    #   regsort({a: 'b', b: 'a', c: 3}, regs)
+    #   #=> [['mov', 'c', 3], ['xchg', 'a', 'b']]
+    #   regsort({a: 'b', b: 'a', c: 'b'}, regs)
+    #   #=> [['mov', 'c', 'b'], ['xchg', 'a', 'b']]
+    #   regsort({a: 'b', b: 'c', c: 'a', x: '1', y: 'z', z: 'c'}, regs)
+    #   #=> [['mov', 'x', '1'],
+    #        ['mov', 'y', 'z'],
+    #        ['mov', 'z', 'c'],
+    #        ['xchg', 'a', 'b'],
+    #        ['xchg', 'b', 'c']]
+    def regsort(in_out, all_regs, randomize: nil)
+      # randomize = context.randomize if randomize.nil?
+
+      # TODO(david942j): stringify_keys
+      in_out = in_out.transform_keys(&:to_s)
+      # Drop all registers which will be set to themselves.
+      # Ex. {eax: 'eax'}
+      in_out.reject! { |k, v| k == v }
+
+      # Check input
+      if (in_out.keys - all_regs).any?
+        raise ArgumentError, format('Unknown register! Know: %p.  Got: %p', all_regs, in_out)
+      end
+
+      # Collapse constant values.
       #
-      # @note
-      #   Different from python-pwntools, we don't support +tmp+/+xchg+ options
-      #   because there's no such usage at all.
-      def regsort(in_out, all_regs, randomize: nil)
-        # randomize = context.randomize if randomize.nil?
-
-        # TODO(david942j): stringify_keys
-        in_out = in_out.map { |k, v| [k.to_s, v] }.to_h
-        # Drop all registers which will be set to themselves.
-        # Ex. {eax: 'eax'}
-        in_out.reject! { |k, v| k == v }
-
-        # Check input
-        if (in_out.keys - all_regs).any?
-          raise ArgumentError, format('Unknown register! Know: %p.  Got: %p', all_regs, in_out)
-        end
+      # Ex. {eax: 1, ebx: 1} can be collapsed to {eax: 1, ebx: 'eax'}.
+      # +post_mov+ are collapsed registers, set their values in the end.
+      post_mov = in_out.group_by { |_, v| v }.each_value.with_object({}) do |list, hash|
+        list.sort!
+        first_reg, val = list.shift
+        # Special case for val.zero? because zeroify registers is cheaper than mov.
+        next if list.empty? || all_regs.include?(val) || val.zero?
 
-        # Collapse constant values
-        #
-        # Ex. {eax: 1, ebx: 1} can be collapsed to {eax: 1, ebx: 'eax'}.
-        # +post_mov+ are collapsed registers, set their values in the end.
-        post_mov = in_out.group_by { |_, v| v }.each_value.with_object({}) do |list, hash|
-          list.sort!
-          first_reg, val = list.shift
-          # Special case for val.zero? because zeroify registers cost cheaper than mov.
-          next if list.empty? || all_regs.include?(val) || val.zero?
-          list.each do |reg, _|
-            hash[reg] = first_reg
-            in_out.delete(reg)
-          end
+        list.each do |(reg, _)|
+          hash[reg] = first_reg
+          in_out.delete(reg)
         end
+      end
 
-        graph = in_out.dup
-        result = []
-
-        # Let's do the topological sort.
-        # so sad ruby 2.1 doesn't have +itself+...
-        deg = graph.values.group_by { |i| i }.map { |k, v| [k, v.size] }.to_h
-        graph.each_key { |k| deg[k] ||= 0 }
-
-        until deg.empty?
-          min_deg = deg.min_by { |_, v| v }[1]
-          break unless min_deg.zero? # remain are all cycles
-          min_pivs = deg.select { |_, v| v == min_deg }
-          piv = randomize ? min_pivs.sample : min_pivs.first
-          dst = piv.first
-          deg.delete(dst)
-          next unless graph.key?(dst) # Reach an end node.
-          deg[graph[dst]] -= 1
-          result << ['mov', dst, graph[dst]]
-          graph.delete(dst)
-        end
+      graph = in_out.dup
+      result = []
 
-        # Remain must be cycles.
-        graph.each_key do |reg|
-          cycle = check_cycle(reg, graph)
-          cycle.each_cons(2) do |d, s|
-            result << ['xchg', d, s]
-          end
-          cycle.each { |r| graph.delete(r) }
-        end
+      # Let's do the topological sort.
+      # so sad ruby 2.1 doesn't have +itself+...
+      deg = graph.values.group_by { |i| i }.transform_values(&:size)
+      graph.each_key { |k| deg[k] ||= 0 }
 
-        # Now assign those collapsed registers.
-        post_mov.sort.each do |dreg, sreg|
-          result << ['mov', dreg, sreg]
+      until deg.empty?
+        min_deg = deg.min_by { |_, v| v }[1]
+        break unless min_deg.zero? # remain are all cycles
+
+        min_pivs = deg.select { |_, v| v == min_deg }
+        piv = randomize ? min_pivs.sample : min_pivs.first
+        dst = piv.first
+        deg.delete(dst)
+        next unless graph.key?(dst) # Reach an end node.
+
+        deg[graph[dst]] -= 1
+        result << ['mov', dst, graph[dst]]
+        graph.delete(dst)
+      end
+
+      # Remain must be cycles.
+      graph.each_key do |reg|
+        cycle = check_cycle(reg, graph)
+        cycle.each_cons(2) do |d, s|
+          result << ['xchg', d, s]
         end
+        cycle.each { |r| graph.delete(r) }
+      end
 
-        result
+      # Now assign those collapsed registers.
+      post_mov.sort.each do |dreg, sreg|
+        result << ['mov', dreg, sreg]
       end
 
-      private
+      result
+    end
 
-      # Walk down the assignment list of a register,
-      # return the path walked if it is encountered again.
+    Pwnlib::Util::Ruby.private_class_method_block do
+      # Walk down the assignment list of a register, return the path walked if it is encountered again.
+      #
       # @example
       #   check_cycle('a', {'a' => 1}) #=> []
       #   check_cycle('a', {'a' => 'a'}) #=> ['a']
@@ -132,16 +131,16 @@ module Pwnlib
         check_cycle_(reg, assignments, [])
       end
 
-      def check_cycle_(reg, assignments, path) # :nodoc:
+      def check_cycle_(reg, assignments, path)
         target = assignments[reg]
         path << reg
-        # No cycle, some other value (e.g. 1)
+        # No cycle, some other value (e.g. 1).
         return [] unless assignments.key?(target)
-        # Found a cycle
+        # Found a cycle.
         return target == path.first ? path : [] if path.include?(target)
+
         check_cycle_(target, assignments, path)
       end
     end
-    extend ClassMethods
   end
 end

data/lib/pwnlib/runner.rb

@@ -0,0 +1,53 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'fileutils'
+
+require 'pwnlib/asm'
+require 'pwnlib/tubes/process'
+
+module Pwnlib
+  # This module collects the methods for executing codes, e.g., assembly code, assembled machine code, etc.
+  module Runner
+    module_function
+
+    # Given an assembly listing, assemble and execute it.
+    #
+    # @param [String] assembly
+    #   Assembly code.
+    #
+    # @return [Pwnlib::Tubes::Process]
+    #   The tube for interacting.
+    #
+    # @see Runner.run_shellcode
+    def run_assembly(assembly)
+      run_shellcode(::Pwnlib::Asm.asm(assembly))
+    end
+
+    # Given assembled machine code bytes, execute them.
+    #
+    # @param [String] bytes
+    #   Assembled code.
+    #
+    # @return [Pwnlib::Tubes::Process]
+    #   The tube for interacting.
+    #
+    # @example
+    #   r = run_shellcode(asm(shellcraft.cat('/etc/passwd')))
+    #   r.interact
+    #   # [INFO] Switching to interactive mode
+    #   # root:x:0:0:root:/root:/bin/bash
+    #   # daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
+    #   # bin:x:2:2:bin:/bin:/usr/sbin/nologin
+    #   # sys:x:3:3:sys:/dev:/usr/sbin/nologin
+    #   # sync:x:4:65534:sync:/bin:/bin/sync
+    #   # games:x:5:60:games:/usr/games:/usr/sbin/nologin
+    #   # [INFO] Got EOF in interactive mode
+    #   #=> true
+    def run_shellcode(bytes)
+      file = ::Pwnlib::Asm.make_elf(bytes, to_file: true)
+      at_exit { FileUtils.rm_f(file) if File.exist?(file) }
+      ::Pwnlib::Tubes::Process.new(file)
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/amd64/common/common.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/helper'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module Amd64
+        # For non os-related methods.
+        module Common
+          extend ::Pwnlib::Shellcraft::Generators::Helper
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/amd64/common/infloop.rb

@@ -0,0 +1,24 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/amd64/common/common'
+require 'pwnlib/shellcraft/generators/x86/common/infloop'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module Amd64
+        module Common
+          # @overload infloop
+          #
+          # @see Generators::X86::Common#infloop
+          def infloop(*args)
+            context.local(arch: :amd64) do
+              cat X86::Common.infloop(*args)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/amd64/common/memcpy.rb

@@ -0,0 +1,35 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/amd64/common/common'
+require 'pwnlib/shellcraft/generators/amd64/common/setregs'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module Amd64
+        module Common
+          # Like +memcpy+ in glibc.
+          #
+          # Copy +n+ bytes from +src+ to +dst+.
+          #
+          # @param [String, Symbol, Integer] dst
+          #   Destination.
+          # @param [String, Symbol, Integer] src
+          #   Source to be copied.
+          # @param [Integer] n
+          #   The number of bytes to be copied.
+          #
+          # @example
+          #   shellcraft.memcpy('rax', 'rbx', 0x1000)
+          def memcpy(dst, src, n)
+            cat "/* memcpy(#{pretty(dst)}, #{pretty(src)}, #{pretty(n)}) */"
+            cat 'cld'
+            cat Common.setregs({ rdi: dst, rsi: src, rcx: n })
+            cat 'rep movsb'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pwnlib/shellcraft/generators/amd64/common/mov.rb

@@ -0,0 +1,131 @@
+# encoding: ASCII-8BIT
+# frozen_string_literal: true
+
+require 'pwnlib/shellcraft/generators/amd64/common/common'
+
+module Pwnlib
+  module Shellcraft
+    module Generators
+      module Amd64
+        module Common
+          # Move +src+ into +dst+ without newlines and null bytes.
+          #
+          # @param [String, Symbol] dst
+          #   Register's name.
+          # @param [String, Symbol, Integer] src
+          #   Register's name or immediate value.
+          # @param [Boolean] stack_allowed
+          #   If equals to +false+, generated assembly code would not use stack-related operations.
+          #   But beware of without stack-related operations the generated code length is longer.
+          #
+          # @example
+          #   context.arch = 'amd64'
+          #   shellcraft.mov('rdi', 'ax')
+          #   #=> "  movzx edi, ax\n"
+          # @example
+          #   context.arch = 'amd64'
+          #   puts shellcraft.mov('rax', 10)
+          #   #   push 9 /* mov eax, '\n' */
+          #   #   pop rax
+          #   #   inc eax
+          #   #=> nil
+          # @example
+          #   context.arch = 'amd64'
+          #   puts shellcraft.mov('rax', 10, stack_allowed: false)
+          #   #   mov eax, 0x1010101
+          #   #   xor eax, 0x101010b /* 0xa == 0x1010101 ^ 0x101010b */
+          #   #=> nil
+          def mov(dst, src, stack_allowed: true)
+            raise ArgumentError, "#{dst} is not a register" unless register?(dst)
+
+            dst = get_register(dst)
+            if register?(src)
+              src = get_register(src)
+              if dst.size < src.size && !dst.bigger.include?(src.name)
+                raise ArgumentError, "cannot mov #{dst}, #{src}: dst is smaller than src"
+              end
+
+              # Downgrade our register choice if possible.
+              # Opcodes for operating on 32-bit registers are always (?) shorter.
+              dst = get_register(dst.native32) if dst.size == 64 && src.size <= 32
+            else
+              context.local(arch: 'amd64') { src = evaluate(src) }
+              raise ArgumentError, format('cannot mov %s, %d: dst is smaller than src', dst, src) unless dst.fits(src)
+
+              orig_dst = dst
+              dst = get_register(dst.native32) if dst.size == 64 && bits_required(src) <= 32
+
+              # Calculate the packed version.
+              srcp = pack(src & ((1 << dst.size) - 1), bits: dst.size)
+
+              # Calculate the unsigned and signed versions.
+              srcu = unpack(srcp, bits: dst.size, signed: false)
+              # N.B.: We may have downsized the register for e.g. mov('rax', 0xffffffff)
+              #       In this case, srcp is now a 4-byte packed value, which will expand to "-1", which isn't correct.
+              srcs = orig_dst.size == dst.size ? unpack(srcp, bits: dst.size, signed: true) : src
+            end
+            if register?(src)
+              if src == dst || dst.bigger.include?(src.name)
+                cat "/* moving #{src} into #{dst}, but this is a no-op */"
+              elsif dst.size > src.size
+                cat "movzx #{dst}, #{src}"
+              else
+                cat "mov #{dst}, #{src}"
+              end
+            elsif src.is_a?(Numeric) # Constant or immi
+              xor = ->(reg) { "xor #{reg.xor}, #{reg.xor}" }
+              if src.zero?
+                # Special case for zeroes.
+                # XORing the 32-bit register clears the high 32 bits as well.
+                cat "xor #{dst}, #{dst} /* #{src} */"
+              elsif stack_allowed && [32, 64].include?(dst.size) && src == 10
+                cat "push 9 /* mov #{dst}, '\\n' */"
+                cat "pop #{dst.native64}"
+                cat "inc #{dst}"
+              elsif stack_allowed && [32, 64].include?(dst.size) && (-2**7 <= srcs && srcs < 2**7) && okay(srcp[0])
+                # It's smaller to PUSH and POP small sign-extended values than to directly move them into various
+                # registers.
+                #
+                # 6aff58           push -1; pop rax
+                # 48c7c0ffffffff   mov rax, -1
+                cat "push #{pretty(src)}"
+                cat "pop #{dst.native64}"
+              elsif okay(srcp)
+                # Easy case. This implies that the register size and value are the same.
+                cat "mov #{dst}, #{pretty(src)}"
+              elsif srcu < 2**8 && okay(srcp[0]) && dst.sizes.include?(8) # Move 8-bit value into register.
+                cat xor[dst]
+                cat "mov #{dst.sizes[8]}, #{pretty(src)}"
+              elsif srcu == srcu & 0xff00 && okay(srcp[1]) && dst.ff00
+                # Target value is a 16-bit value with no data in the low 8 bits, we can use the 'AH' style register.
+                cat xor[dst]
+                cat "mov #{dst.ff00}, #{pretty(src)} >> 8"
+              elsif srcu < 2**16 && okay(srcp[0, 2]) # Target value is a 16-bit value, use a 16-bit mov.
+                cat xor[dst]
+                cat "mov #{dst.sizes[16]}, #{pretty(src)}"
+              else # All else has failed.  Use some XOR magic to move things around.
+                a, b = xor_pair(srcp, avoid: "\x00\n")
+                a = hex(unpack(a, bits: dst.size))
+                b = hex(unpack(b, bits: dst.size))
+                if dst.size != 64
+                  # There's no XOR REG, IMM64 but we can take the easy route for smaller registers.
+                  cat "mov #{dst}, #{a}"
+                  cat "xor #{dst}, #{b} /* #{hex(src)} == #{a} ^ #{b} */"
+                elsif stack_allowed
+                  # However, we can PUSH IMM64 and then perform the XOR that way at the top of the stack.
+                  cat "mov #{dst}, #{a}"
+                  cat "push #{dst}"
+                  cat "mov #{dst}, #{b}"
+                  cat "xor [rsp], #{dst} /* #{hex(src)} == #{a} ^ #{b} */"
+                  cat "pop #{dst}"
+                else
+                  raise ArgumentError, "Cannot put #{pretty(src)} into '#{dst}' without using stack."
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end